News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 5 May· 44 articles
-
CVE-2026-31431: Linux Kernel Flaw Enables Root via Simple Script
Copy Fail, CVE-2026-31431, is described as a deterministic local privilege escalation in the Linux kernel’s AF_ALG interface, enabling an unprivileged attacker to gain root across many distributions since 2017. According to The Linux Foundation, the advisory…
-
Trellix confirms source code repo breach, starts forensic review.
Trellix has disclosed that a threat actor recently gained unauthorized access to a portion of its source code repository, though the company says it cannot specify what portion was affected. In its statement, Trellix asserted that there is no evidence the…
Dark Reading -
Karakurt2 articles this day · SecurityWeek first
Latvian Karakurt Ransomware Negotiator Gets 8.5 Year US Sentence · Latvian Karakurt ransomware member sentenced to 8.5 years in US
2 outlets-
Latvian Karakurt Ransomware Negotiator Gets 8.5 Year US Sentence
Deniss Zolotarjovs, a Latvian national linked to the Karakurt ransomware gang, has been sentenced in the U.S. to 102 months (8.5 years) in prison after pleading guilty to money laundering and fraud tied to ransomware operations. The DoJ press release…
Security Affairs -
Latvian Karakurt ransomware member sentenced to 8.5 years in US
A Latvian member of the Karakurt ransomware gang, Deniss Zolotarjovs, was sentenced to 8.5 years in prison in the US for his involvement in extortion. He was arrested in Georgia in December 2023 and extradited to the US in August 2024, and he pleaded guilty…
SecurityWeek
-
-
Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack
According to Kaspersky, Daemon Tools, a widely used app for mounting disk images, was backdoored in a monthlong supply-chain compromise that began on 8 April 2026 and remained active as of the time of reporting. Installers signed by the developer’s official…
Ars Technica -
ShinyHunters2 articles this day · Security Affairs first
Vimeo confirms data breach via Anodot, exposing 119k users · Instructure investigating Canvas breach after ShinyHunters claim
1 outlet-
Vimeo confirms data breach via Anodot, exposing 119k users
Vimeo confirmed a data breach stemming from a compromise at Anodot, a third‑party analytics vendor, exposing data for 119,000 users. The incident, which occurred in April 2026, is linked to the ShinyHunters extortion group, who reportedly listed Vimeo on…
Security Affairs -
Instructure investigating Canvas breach after ShinyHunters claim
Instructure, the U.S.-based educational technology firm behind Canvas, is investigating a cyber incident that exposed users’ personal data, with the company stating the incident is contained as investigations continue. The breach appears to involve…
Security Affairs
-
-
Apache Software Foundation Apache HTTP Server2 articles this day · SecurityWeek first
Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918 · Apache patches HTTP Server and MINA flaws, warns of RCE risk
-
Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918
The Apache Software Foundation has released security updates for HTTP Server addressing CVE-2026-23918, a vulnerability described as a “double free and possible RCE” in HTTP/2 handling with a CVSS of 8.8. The flaw affects Apache HTTP Server 2.4.66 and is…
-
Apache patches HTTP Server and MINA flaws, warns of RCE risk
SecurityWeek reports that Apache released patches for more than a dozen vulnerabilities affecting HTTP Server and MINA, including critical and high-severity issues that could enable remote code execution. The HTTP Server 2.4.67 update fixes 11…
-
-
Trojanised DAEMON Tools installers spread QUIC RAT backdoor
According to Kaspersky, a newly identified supply chain attack has compromised DAEMON Tools installers with a malicious payload, distributed from the official DAEMON Tools website and signed with digital certificates belonging to DAEMON Tools developers. The…
The Hacker News -
Microsoft Flags Mass Phishing Campaign Using Fake Compliance Emails
A mass phishing campaign identified by the Microsoft Defender Research team targeted more than 35,000 users across 13,000 organisations, using fake internal compliance or regulatory communications as lures. The lures employed polished, enterprise-style HTML…
Infosecurity -
APT372 articles this day · The Hacker News first
North Korean Hackers Trojanise Korean Gaming Site to Spy on Users · ScarCruft deploys Android BirdCall backdoor via sqgame.net
2 outlets-
North Korean Hackers Trojanise Korean Gaming Site to Spy on Users
A North Korea-aligned espionage group known as ScarCruft, also referred to as APT37, Reaper and Ricochet Chollima, has compromised a regional gaming platform serving ethnic Koreans in China, according to new analysis from ESET researchers. The operation…
Infosecurity -
ScarCruft deploys Android BirdCall backdoor via sqgame.net
ScarCruft, the North Korea-aligned threat group, has compromised the sqgame[.]net gaming platform in a supply-chain style attack and trojanised its components with a backdoor named BirdCall, likely to target ethnic Koreans in China. While earlier BirdCall…
The Hacker News
-
-
Edge passwords exposed in memory, researcher warns of theft risk
Microsoft Edge stores passwords in process memory, a design that a security researcher described as potentially enabling broad credential access in enterprise environments. A proof‑of‑concept tool demonstrated that an administrator could steal saved Edge…
Dark Reading -
Microsoft Warns of Code of Conduct Phishing Targeting 13k Firms
Microsoft has issued a warning regarding a sophisticated phishing campaign targeting organizations in the U.S. This campaign, themed around a 'code of conduct review', has resulted in over 35,000 phishing attempts detected from April 14 to 16, affecting…
SecurityWeek -
China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
A Cisco Talos–tracked operation attributed to a sophisticated China-nexus APT group has targeted government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025, under the moniker UAT-8302. According to…
The Hacker NewsUAT-8302 -
Google patches Android adbd flaw enabling remote code execution
Google patched a critical Android flaw (CVE‑2026‑0073) that could let attackers run code remotely without user action, in the System component. The update prevents potential full device compromise from remote exploitation, with the advisory noting that…
Security Affairs -
Phishing attack uses signed RMM to backdoor 80+ US organisations
A long-running phishing operation that abuses signed remote monitoring and management (RMM) software to plant silent, persistent backdoors on victim machines has compromised more than 80 organisations, predominantly in the US. Codenamed Venomous#Helper and…
Infosecurity -
AI Red Teamer Joey Melo Moves From Counter Strike to CrowdStrike
Joey Melo, described as an AI red teamer, explains that his hacking style is about controlling the environment without changing the underlying rules, a mindset he traces back to tinkering with Counter-Strike configurations. He is currently a Principal…
SecurityWeek -
Microsoft Edge passwords exposed in plain text via memory dump
Edge stores all of your browser passwords in clear text, even if you haven’t used them in this session.
SANS ISC -
Bleeding Llama bug leaks secrets from 300k Ollama servers
Dubbed Bleeding Llama, the heap out-of-bounds read issue in Ollama can be exploited remotely without authentication. Roughly 300,000 Ollama deployments are prone to sensitive information theft through this unauthenticated vulnerability, Cyera warns. The bug,…
-
ABB B&R PVI
According to ABB PSIRT, ABB became aware of a vulnerability in ABB B&R PVI, with an update now available to address it. The affected product versions are PVI <6.5.0, 6.5.0 and the vulnerability is CVE-2026-0936, which could allow an authenticated local…
-
Hitachi Energy PCM600
Hitachi Energy PCM600 is the subject of a CISA ICS Advisory released on 5 May 2026, with the advisory noting a vulnerability that can impact the integrity of the PCM600 product. According to Hitachi Energy, the affected PCM600 Legacy versions are…
-
CISA alerts to DLL hijack flaw in Johnson Controls AC2000
According to CISA, the Johnson Controls CEM AC2000 is vulnerable to DLL hijacking that could allow a standard user to escalate privileges on the host machine. The affected products are CEM AC2000 12.0, 11.0 and 10.6, identified under CVE-2026-21661, with a…
-
CVE-2025-11043 Flaw Lets Attackers Spoof ABB B&R Servers
According to ABB PSIRT SA25P004 republished by CISA, ABB B&R Automation Studio contains a vulnerability affecting Automation Studio <6.5, 6.5 (CVE-2025-11043) that could allow an unauthenticated attacker on the network to masquerade as a trusted party when…
-
DoS flaw impacts ABB B&R Automation Runtime, CVE-2025-11044
According to ABB PSIRT, the ABB B&R Automation Runtime advisory confirms a vulnerability affecting Automation Runtime versions <6.5, >=6.5, and =R4.93, tracked as CVE-2025-11044 (with CVSS 3.1 base score 6.8). The advisory notes that an unauthenticated…
-
Security team patches critical Android RCE bug CVE-2026-0073
SecurityWeek reports that CVE-2026-0073 is a critical remote code execution flaw affecting Android’s System component, which can be exploited without any user interaction. The advisory notes the issue lies in adbd, the Android Debug Bridge daemon, a…
-
Persistent OAuth Tokens Pose Rising Threat as AI Apps Multiply
OAuth tokens granted to Google or Microsoft apps are described as persistent, with no expiration and little if any centralized visibility, a pattern the article says leaves organisations exposed as employees connect AI tools, workflows, and productivity…
The Hacker NewsUNC6395 -
A 2006 USB Drop Test That Redefined Social Engineering Tactics
According to Dark Reading, the piece that became a milestone was Steve Stasiukonis’s column “Social Engineering, the USB Way,” published after Dark Reading recruited him a few days after its launch in 2006, and it went viral, helped by Slashdot coverage and…
Dark Reading -
How a 2006 USB Drop Test Sparked a Social Engineering Legend
The piece revisits Dark Reading’s history with a 2006 pen test in which thumb drives were planted in a credit union’s parking lot to probe employee behaviour, an experiment that Steve Stasiukonis and his team carried out after coordinating with Tim Wilson…
Dark Reading -
MetInfo CMS2 articles this day · SecurityWeek first
Attackers exploit CVE-2026-29014 to hijack MetInfo CMS · MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs
-
Attackers exploit CVE-2026-29014 to hijack MetInfo CMS
MetInfo CMS is under active exploitation of a critical code injection flaw, CVE-2026-29014, which carries a CVSS of 9.8 and can lead to remote code execution. According to the NIST National Vulnerability Database, versions 7.9, 8.0 and 8.1 contain an…
-
MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs
MetInfo has a critical unauthenticated PHP code injection flaw tracked as CVE-2026-29014 (CVSS 9.8) that attackers can exploit to achieve remote code execution, with the issue disclosed in early April and now being actively exploited. According to VulnCheck,…
-
-
SSL.com rotates their root certificate today, (Tue, May 5th)
SSL[.]com is rotating out its root certificate today, a move described as normal, business as usual for a certificate authority. The change was announced by SSL[.]com on 5 May 2026, with guidance urging users to review their configurations if they go beyond…
SANS ISC -
Meta fixes two WhatsApp bugs: CVE‑2026‑23866, CVE‑2026‑23863
Two flaws in WhatsApp have been patched by Meta, which says there is no evidence these bugs have been exploited in the wild. The vulnerabilities could be abused to interfere with how media and attachments are handled on your device, though they do not…
Malwarebytes -
Many Firms Use AI Without Safety Policies, ISACA Warns
AI has become embedded in organisations, yet fewer than half have any form of AI safety or security policies in place, potentially leaving them exposed to data breaches, privacy failures and other cyber threats, according to ISACA. The ISACA AI Pulse Poll,…
Infosecurity -
Over One Million AI Services Exposed Due to Missing Auth.
According to The Hacker News, a scan of certificate transparency logs pulled just over 2 million hosts, exposing about 1 million AI services. The assessment found that many of these AI infrastructures were deployed with no authentication by default, meaning…
The Hacker News -
UK organisations urged to ready for AI driven patch wave
Security experts have urged UK organisations to get ready for a surge in new software updates driven by vendors using powerful AI tools to find and fix vulnerabilities, with the NCSC’s CTO Ollie Whitehouse predicting a “forced correction” to address years of…
Infosecurity -
Microsoft warns of huge phishing scam stealing login tokens
Microsoft disclosed a major phishing campaign that targeted over 35,000 users across 26 countries in mid-April 2026, stealing authentication tokens via fake code-of-conduct emails and legitimate services. According to the report published by Microsoft,…
Security Affairs -
WhatsApp fixes attachment spoof and AI mediated URL bug
Meta-owned WhatsApp has published two security advisories describing vulnerabilities that were patched earlier this year in the messaging app. One is CVE-2026-23863, a medium‑impact attachment spoofing issue affecting WhatsApp for Windows prior to version…
-
Trellix Confirms Source Code Breach, Launches Forensic Probe
According to Infosecurity Magazine, a leading US cybersecurity vendor has been breached by threat actors who accessed its source code, with Trellix disclosing the incident on May 4 and stating it has notified law enforcement and is working with leading…
Infosecurity
